Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0838_modify-alarm-settings
Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios.
Passed 17 of 21 test cases with the skill, and 9 of 21 without it.
and 15 more in the full report
9 fixed9 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our OT security team is reviewing communication security between engineering applications and field controllers to prevent rogue software tools from modifying alarm limits. Which MITRE ICS mitigation applies to authenticating software applications and devices?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies mitigation M0813 Software Process and Device Authentication | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes.
If an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a Impact could occur.
In ICS environments, the adversary may have to use Alarm Suppression or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Modify Alarm Settings by examining operational technology systems and network architecture.
Review whether mitigations for T0838 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.
test cases passed, vs 9 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.